Short PIN Audit

A three-digit PIN was hashed once with SHA-256. Audit the complete stated keyspace locally before sending a single recovered candidate to the board.

Objective

Perform a bounded offline search while preserving leading zeroes.
Explain why a fast hash cannot compensate for a tiny secret space.

Before you begin

Open /challenge/hard/pin and review small local searches.

Concepts

A deterministic fast hash lets an attacker test guesses offline. A three-digit space has only 1,000 candidates, regardless of the digest's length.

Suggested tools

Python: Format candidates as exactly three digits and compare SHA-256 hexadecimal digests locally.

Tool practice

Rehearse the worked tool exercise before using challenge data.

Save the bounded-search example as a Python file and run it locally. Print the first and last formatted candidates before hashing: both must be exactly three characters. An empty result means no match was printed; check the copied digest and input formatting before any board request.

Investigation

Observe

Record the displayed digest, the declared algorithm, and the exact keyspace.

Form a hypothesis

Will exactly one formatted value from 000 through 999 match?

Test carefully

Search locally, then submit only the matching candidate once.

Progressive hints

Hint 1

Use f"{number:03d}" for each candidate.

Hint 2

Hash the UTF-8 bytes and compare hexdigest().

Hint 3

Stop at the single match and send it as the pin query value.

Troubleshooting and reset

If no value matches, check lowercase hexadecimal, UTF-8 encoding, and leading zeroes. Do not send 1,000 requests to the device.